01 Briefing
An enterprise estate produces vulnerability findings faster than any team can remediate them — scanners, penetration tests, and a bug-bounty programme all feeding the same queue. Treating that queue as first-in-first-out, or even highest-CVSS-first, means spending scarce engineering time on the wrong risks.
The job documented here: turn a raw finding firehose into a defensible, risk-ranked remediation programme — and get the fixes actually shipped by teams whose day job is something else.
02 Threat model
The queue mixes three very different kinds of finding, and the triage has to tell them apart:
- Exploited-in-the-wild — vulnerabilities with threat-intelligence evidence of active exploitation; the clock is already running.
- High-severity-on-paper — critical CVSS scores on assets that are isolated, compensated, or carry little business impact.
- Externally reported — bug-bounty submissions, where validation and researcher communication precede any score.
03 Method
- Aggregate — infrastructure scans (Nessus), group VM tooling, and bug-bounty submissions land in one queue.
- Validate & deduplicate — confirm the finding is real, reachable, and not already tracked.
- Score — CVSS as the baseline severity, applied consistently, never as the final answer.
- Overlay threat intelligence — active exploitation, exploit maturity, and exposure reorder the queue; OWASP and CIS benchmarks frame the weakness class.
- Prioritise by business risk — asset criticality and blast radius decide what the next engineering hour goes to.
- Drive to closure — remediation with the owning team, or a formal risk-acceptance decision with an owner and a review date. Nothing exits the queue silently.
04 Findings
- Remediation velocity is a relationship problem. Fixes shipped fastest where the security team turned findings into clear, scoped asks for the owning team — partnership, not ticket-lobbing.
- Exceptions need a formal path. A risk-acceptance process with named owners and review dates keeps "we'll fix it later" honest — deferred risk stays visible instead of dissolving.
- Bug-bounty findings punch above their CVSS. An external researcher reaching a vulnerability is itself exposure evidence, and triage weighs that accordingly.
05 Impact
- Engineering time lands on the highest business risk — not the loudest scanner or the scariest score.
- Risk decisions became auditable — every finding closes through remediation or an owned, dated acceptance, which is exactly what a regulator or auditor asks to see.
- Security speaks the business's language — "this is exploited in the wild and touches the payment path" moves a roadmap in a way "CVSS 9.8" never does.